The National Center for Personal Data Protection (NCPDP), for informational and practical purposes, reports on the administrative fine in the amount of 4,375,273 euros imposed by the Polish Data Protection Authority (SA) on the company ING Bank Śląski S.A. for violating Article 5 (Principles related to the processing of personal data) and Article 6 (Lawfulness of processing) of the GDPR.

      Between April 1, 2019 and September 23, 2020, the bank systematically collected copies of ID cards, without verifying whether this practice was justified by Act on Counteracting Money Laundering and Financing of Terrorism (AML Law). In many cases, the provision of banking services was conditional on scanning the identity document, even in situations that did not require financial security measures (for example, in processing a complaint at an ATM).

       Following the investigation, it was found that the bank did not conduct an individual AML/CFT risk assessment, did not justify the need to scan documents in all cases, and processed personal data without an appropriate legal basis.

       In this context, the Polish SA imposed an administrative fine of EUR 4 375 273 on ING Bank Śląski for violating Article 5 (1) a), b), c) – the principles of lawfulness, purpose limitation and data minimization and Article 6 (1) – the lawfulness of processing of the GDPR.

       NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

       The National Center for Personal Data Protection (NCPDP), for informational and practical purposes, reports on the administrative fine of 4 022 773 euros for McDonald’s Polska Limited Liability Company (LLC) and 43,680 euros for 24/7 Communication LLC applied by the Polish Data Protection Authority (SA) for violating Article 5 (Principles related to the processing of personal data), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject) and Article 38 (Position of the data protection officer) of the GDPR.

       McDonald’s Polska LLC notified a data security breach, as a controller, finding that the following data of its employees and franchisees were included in the shared file in the public catalogue: names, personal identification numbers (PESEL numbers), passport numbers (if the PESEL number is not available), McDonald’s restaurant number, date and time of starting work, date and time of ending work, number of hours worked, holidays, type of work, etc.

       The investigation found that neither the controller (McDonald’s Polska) nor the processor (24/7 Communication) had conducted a risk analysis and had not implemented sufficient technical and organizational measures to protect personal data. Furthermore, the data protection officer was not properly involved, and the audit and monitoring obligations of the partners were not respected.

       The Polish SA emphasized that the responsibility for data protection lies with both companies that collect and manage personal data and their contractual partners. Security measures must be constantly checked and updated, not just at the beginning of data processing.

       In this context, the Polish SA imposed an administrative fine of 4 022 773 euros on McDonald’s Polska LLC and 43 680 euros on 24/7 Communication LLC.

       NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

       On October 13, 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for debutants customs officials, at the request of the Customs Service (CS).

       The purpose of the training session was to increase the level of perception of debutants customs officials on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.  

       Important topics were discussed during the event, such as: defining general notions related to the field of personal data protection; principles and legal grounds for the processing of personal data; rights of personal data subjects; processing of special categories of personal data; requirements regarding the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of processed personal data; aspects related to the Data Protection Impact Assessment (DPIA), etc.

       The training provided participants with a clear perspective on how the principles of legality, transparency and security of personal data must be respected in daily activity.  Through practical examples and interactive discussions, debutants customs officials learned how to recognize the risks of unauthorized data processing and how to apply effective protection measures. The training also represented an important step in strengthening the relationship of trust between customs officials and citizens. By correctly understanding data protection principles and applying them in their daily work, they become promoters of an organizational culture based on integrity, responsibility and respect for the confidentiality of the information managed.

       25 debutants customs officials were trained during the event.    

     On September 25, 2025, the National Center for Personal Data Protection (NCPDP), organized a training session in the field of personal data protection for representatives of the Investment Agency, at their request.

       The purpose of the training course was to increase the level of perception of the Investment Agency employees on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

       Important topics were addressed during the event, such as: the definition of general concepts related to the field of personal data protection; the rights of data subjects; the processing of special categories of personal data; the principles and legal grounds for the processing of personal data; the aspects related to the appointment of the Data Protection Officer (DPO); ensuring the security and confidentiality of personal data by employees of the Investment Agency; examining requests for disclosure of personal data and access to information of public interest from the perspective of the legislation on the protection of personal data, etc.

       The training provided by NCPDP was particularly useful for the representatives of the Investment Agency as they gained a better understanding of the requirements provided by national and European data protection legislation, thus allowing the institution to prevent potential legal risks and sanctions. At the same time, the knowledge acquired will contribute to improving internal processes, such as integrating data protection principles into information collection, storage and processing activities, while optimizing internal work procedures, and the correct application of data protection standards will contribute to strengthening the image of the Investment Agency as a modern, transparent and responsible institution, an essential aspect in the relationship with investors, partners and the general public.

       During the event, 20 representatives of the Investment Agency were trained.

       On September 19, 2025, the National Center for Personal Data Protection organized a training session in the field of personal data protection for representatives of the General Inspectorate for Migration (GIM), South Regional Directorate, in accordance to the training plan within the GIM for 2025, approved and signed by the heads of the NCPDP and the GIM on January 27th.

       The purpose of the training course was to increase the level of perception of GIM employees, South Regional Directorate, on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

       Important topics were discussed during the event, such as:

• The definition of general concepts related to personal data protection;
• The rights of personal data subjects;
• The processing of special categories of personal data;
• The principles and legal grounds for data processing;
• Requirements regarding the personal data protection in the exercise of official duties;
• Aspects related to the appointment of the Data Protection Officer (DPO);
• Obligations and tasks of a DPO;
• Ensuring the security and confidentiality of processed personal data, etc.

       The training course proved to be interactive, with participants asking multiple questions to which they received thorough answers/explanations related to the field of personal data protection from the trainers.

       The event took place online, being trained 17 representatives from GIM, South Regional Directorate.

       On September 17, 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for the representatives of structural and specialized subdivisions of the General Inspectorate for Migration (GIM) according to the training plan within the GIM for 2025, approved and signed by the heads of the NCPDP and GIM on January 27 of this year.

       The aim of the training course was to increase the GIM employees’ awareness on the principles of personal data protection, as well as to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

       During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the requirements for personal data protection in the exercise of their duties; aspects related to the appointment of the Data Protection Officer (DPO); the obligations and tasks of a DPO; ensuring the security and confidentiality of personal data processed, etc.

       The training course was an interactive one, and the aspects related to the proper procedure of accessing personal data through the State Information Systems, including the application of exceptions and restrictions regulated in article 15 of Law 133/201, the correctness of examining inquiries containing personal data, as well as the requirements regarding the protection of personal data in the exercise of official duties, were of great interest to the course participants.

       The event was attended by around 14 representatives from the structural and specialized subdivisions of the General Inspectorate for Migration.

       On September 11, 2025, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for employees of the Moldova Post Office, at their request.

       The purpose of the training course was to increase the awareness of Moldova Post Office employees regarding the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime for personal data in accordance with the provisions of the legislation in force.

       During the event, important topics were discussed, such as:

• The definitions of general concepts related to the field of personal data protection;
• The rights of personal data subjects;
• The processing of special categories of personal data;
• The principles and legal grounds for processing personal data;
• The aspects related to the appointment of the Data Protection Officer (DPO);
• The obligations and tasks of a DPO;
• Aspects related to the Data Protection Impact Assessment (DPIA);
• The stages and obligation to carry out a DPIA, etc.

       The training course was interactive, with participants asking multiple questions regarding the legal processing of personal data in the daily activities carried out by company employees, the most important changes introduced by Law 195/2024 on personal data protection, ensuring the security and confidentiality of processed personal data, as well as the access to information of public interest in the context of personal data protection legislation.

       About 60 representatives from the Moldova Post Office participated in the event.

 On September 3, 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for the representatives of the National Office of Social Insurance (NOSI) at their request.

       The purpose of the training session was to increase the level of perception of NOSI employees on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

The event addressed important topics, such as:

• The definition of general concepts related to the field of personal data protection;
• The rights of personal data subjects;
• The processing of special categories of personal data;
• The principles and legal grounds for personal data processing;
• The requirements regarding the personal data protection in the exercise of official duties, etc.

The training course was interactive, the topics related to the lawfulness of requests for disclosure of personal data to third parties, as well as ensuring the security and confidentiality of personal data processed by NOSI employees, presented a high interest for the course participants.

The event was held online, and was attended by 40 representatives of NOSI from Briceni, Cimișlia, Ocnița, Rezina, Soroca, Sângerei, Șoldănești and Ștefan Vodă.

       On July 8, the National Center for Personal Data Protection (NCPDP) continued the information and awareness campaign of the school community, organizing the training course “Personal data protection and children’s safety in the online environment” for students from the National Center for Digital Innovations in Education ” Clasa Viitorului ” in Chisinau.

The aim of the campaign is to raise awareness and educate children regarding: the importance of personal data protection; identifying risks in the online environment; adopting responsible, safe and informed behavior in the digital space to support children to browse the internet in an ethical and informed manner, reducing their vulnerability to online threats.

       The topics addressed in the training cocerned:

–         General notions regarding personal data (what it means, how we identify it, how we operate with it);

–         Attitudes and practices when sending pictures/videos online (the privacy of a social networking page, privacy settings, working with pictures/videos in a chat, attitude and actions taken in case a picture/video is taken without your consent and subsequently distributed);

–         Communication on social networks, etc.

       At the same time, the trainers from the NCPDP carried out a series of interactive and educational activities, adapted to the students’ level of understanding, aimed at increasing the level of involvement and interest in the topics addressed. Among the most relevant activities are: a question and answer contest (quiz); role-playing games; “True or false” type games, as well as completing a crossword puzzle based on the material presented. All children were awarded with appropriate gifts.

       Through these activities, students became more receptive to the messages conveyed, demonstrated a better understanding of the risks in the digital environment, and were motivated to talk to their parents and teachers about their online experiences. The contests and games contributed to a positive, interactive educational climate focused on developing real digital safety skills.

       The event was organized in the context of celebrating the 17 years of activity of the NCPDP, and 38 students were trained. At the same time, the information materials, as well as the gifts offered to the students, were developed with the support of the United Nations Children’s Fund (UNICEF).

       It should be noted that the school community information and awareness campaign was launched on April 15, 2022. During the current year, 215 students were trained. NCPDP aims to continue this format of training for school communities both in school institutions in Chisinau municipality and in those in the districts of the Republic of Moldova.